Malicious Twitch browser extension JeetBot exposes over 30,000 user OAuth tokens to Russian bot service infrastructure

A malicious browser extension marketed as a utility for Twitch users has been caught systematically exfiltrating sensitive authentication credentials to third-party servers. According to a comprehensive security analysis conducted by software supply chain security firm Socket, the extension, titled Twitch Enhanced Viewer | JeetBot, has been forwarding the live OAuth session tokens of approximately 31,000 users to proxy servers managed by a commercial Russian botting operation. This incident represents a significant breach of user privacy and highlights the persistent dangers posed by seemingly benign browser extensions that operate with elevated permissions.

The extension, which was available on both the Google Chrome Web Store and the Mozilla Firefox Add-ons store as of mid-September, purported to enhance the user experience by providing ad-blocking capabilities, forcing 1080p stream resolution, and bypassing regional content locks. However, the mechanism required to deliver these features—routing video-playlist traffic through external JeetBot proxy servers—was leveraged to silently intercept and transmit sensitive account-level data.

The Anatomy of the Exfiltration

At the core of the security vulnerability is the mishandling of OAuth bearer tokens. When a user authenticates with Twitch, they are issued a session token that grants the browser the authority to act on behalf of the user. Socket’s investigation revealed that the JeetBot extension appended these high-privilege tokens as URL query parameters during the traffic redirection process. Because these requests were routed through the developer’s proxy infrastructure, the tokens were written in cleartext into the proxy’s server logs.

The gravity of this exposure cannot be overstated. Unlike lower-level playback tokens, the intercepted data consisted of account-scoped Twitch tokens. Possessing such a token allows a malicious actor to perform a wide array of actions as the victimized user, including reading and sending private "Whispers," posting messages in chat, and spending platform-specific currency such as Channel Points. Critically, because the token acts as a bearer credential, the attacker does not require a password, a secondary authentication factor, or physical access to the device to hijack the account session.

Evidence suggests the exfiltration was a deliberate design choice rather than an accidental technical oversight. Socket noted that the extension already possessed the capability to handle playback-specific tokens separately. Furthermore, the extension was programmed with a hardcoded list of 10 Russian-language streamer channels for which it routed traffic through the same proxy servers without attaching the account-level OAuth token. This discrepancy demonstrates that the developers possessed the technical capacity to isolate traffic effectively but chose to expose user credentials for all other channels.

A Chronology of Malicious Activity

The timeline of the JeetBot extension suggests a long-term, evolving effort to harvest user credentials. While the recent discovery focused on the inline forwarding of tokens, earlier iterations of the extension were even more brazen in their data collection tactics.

In version 4.8, released in January 2026, the extension was explicitly designed to transmit captured tokens to a dedicated "set-token" endpoint residing on JeetBot infrastructure, with redundant backups stored on two separate Deno services. These older builds implemented a five-second cooldown mechanism and a last-token-sent tracker, features that indicate a sophisticated data-harvesting operation rather than a functional utility. Furthermore, the source code of these versions contained internal instructions written in Russian, commanding the extension to fail silently if the transmission of the token to the malicious server was unsuccessful.

The development pattern took a notable turn between April and May. Version numbers jumped from 7.2.6 in April to 85.2.2 in May, a drastic increase that coincided with the shift from explicit token-storing endpoints to the current method of inline forwarding via proxy logs. This transition suggests an attempt to obfuscate the collection process by blending it into the legitimate traffic flow of the extension’s purported video-quality features.

Discrepancy in Data Safety Policies

The JeetBot extension presents a stark example of the "trust gap" in browser extension ecosystems. Despite the technical evidence of data exfiltration, the Chrome Web Store’s "Data Safety" section for the extension explicitly claimed that the developer would not collect, use, or sell user data to third parties. Similarly, the extension’s linked privacy policy contained blanket assertions that no user data was collected, stored, or processed.

These false disclosures provided a veneer of legitimacy that likely encouraged tens of thousands of users to install the software. The lack of rigorous automated auditing of extension code—specifically regarding how extensions interact with third-party network requests—remains a significant challenge for platform maintainers like Google and Mozilla.

Mitigation and Remediation for Affected Users

Socket has issued an urgent advisory for all individuals who have installed the Twitch Enhanced Viewer | JeetBot extension. Users are instructed to take immediate action to secure their accounts:

1. Remove the Extension: Navigate to the browser’s extension management settings and uninstall the software immediately.
2. Invalidate Sessions: Access the Twitch account settings menu and navigate to the "Security and Privacy" tab. Users must select the option to "Log out of all devices" to terminate all active sessions, which effectively invalidates any OAuth tokens that may have been intercepted by the proxy servers.
3. Re-authenticate: Log back into the account through official Twitch channels.

For enterprise security teams and IT departments, this incident serves as a stark reminder of the risks associated with browser-based extensions. Security professionals should treat any browser extension that possesses host permissions for an authenticated service—particularly when combined with third-party proxy destinations—as a high-risk vector for credential exposure. Organizations are encouraged to implement strict allow-lists for browser extensions and utilize endpoint detection and response (EDR) tools to monitor for unusual outbound traffic patterns from browser processes.

Broader Implications for Browser Security

The JeetBot case is far from an isolated event. In recent years, the browser extension ecosystem has seen a surge in malicious activity, with extensions often being used to hijack internal business tools, such as Workday or Netsuite, or to perform large-scale data harvesting. The prevalence of these extensions is often driven by the "freemium" model, where users sacrifice security for convenient quality-of-life improvements.

As browser vendors continue to grapple with the tension between user customization and platform security, the responsibility for vetting these tools often falls on the end-user or the organization. The reliance on third-party proxies, as seen in this incident, introduces a "man-in-the-middle" vulnerability that is difficult for standard antivirus software to detect, as the malicious traffic is often encrypted or masked as legitimate video streaming data.

Industry experts suggest that more transparency is required from extension developers, particularly regarding the routing of data through third-party infrastructure. Increased scrutiny of the "Data Safety" declarations provided by developers, coupled with more robust sandboxing for extensions that require broad network permissions, may be necessary to stem the tide of such credential-exposure incidents.

At the time of writing, Google, Mozilla, and Twitch have been approached for comment regarding the status of the extension listings and the potential for a coordinated takedown. As of the latest update, the extension remains available on the major web stores, leaving thousands of users potentially exposed. Users are advised to exercise extreme caution when installing extensions that promise to alter the behavior of major streaming platforms, as the potential for unauthorized data exfiltration remains a critical and under-addressed threat in the modern digital landscape.